recommend `semanage fcontext` for selinux #1336

immanetize · 2017-08-01T00:08:08Z

Using chcon isn't ideal, better to set and apply a default policy. Files can end up with a 'wrong' label for all sorts of reasons (most commonly a mv, so I made a specific note about that) using chcon can be tedious. It's much more convenient post-deployment to run restorecon -R /path.

A bunch of webservers should have appropriate policy:

[root@magento ~]# grep httpd_exec_t /etc/selinux/targeted/contexts/files/file_contexts|grep bin
/usr/sbin/httpd(\.worker)?      --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/apache(2)?    --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/apache-ssl(2)?        --      system_u:object_r:httpd_exec_t:s0
/usr/share/jetty/bin/jetty.sh   --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/nginx --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/thttpd        --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/php-fpm       --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/cherokee      --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/lighttpd      --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/httpd\.event  --      system_u:object_r:httpd_exec_t:s0
/usr/bin/mongrel_rails  --      system_u:object_r:httpd_exec_t:s0
/usr/sbin/htcacheclean  --      system_u:object_r:httpd_exec_t:s0

... but it seems better not to go into it, so I simply changed ~"It will only work with Apache" to ~"ymmv". In practice, I'd say that a web server that wasn't shipped SELinux-friendly and appropriately confined should simply not be used in production, but this doc is not my soapbox :)

whatsnew
Replaced chcon commands with semanage and restorecon in the installation security section.

Fix typos

jeff-matthews · 2018-12-13T19:49:07Z

Sorry for the long delay processing this @immanetize. Please update the 2.1 and 2.3 files and I'll merge this.

jeff-matthews · 2018-12-13T19:54:43Z

guides/v2.0/install-gde/prereq/security.md

-	chcon -R --type httpd_sys_rw_content_t <your Magento install dir>/var
-	chcon -R --type httpd_sys_rw_content_t <your Magento install dir>/pub/media
-	chcon -R --type httpd_sys_rw_content_t <your Magento install dir>/pub/static
+	export mageroot="/path/to/your_magento_install_dir"


All these commands should be wrapped in code fences and separated by && so you can copy/paste the whole block and run it in a terminal.

>```bash >export mageroot="/path/to/your_magento_install_dir" >... >```

jeff-matthews · 2018-12-13T19:56:26Z

guides/v2.0/install-gde/prereq/security.md


-The preceding commands work only with the Apache web server. Because of the variety of configurations and security requirements, we don't guarantee these commands work in all situations. For more information, see:
+The first command sets an environment variable to the root directory of your Magento installation directory, verify and substitute the correct path.  The `semanage` commands set the default file context for directories that Magento needs to write to, and the `restorecon` command applies the contexts in policy to the files on disk.  


Suggested change

The first command sets an environment variable to the root directory of your Magento installation directory, verify and substitute the correct path. The `semanage` commands set the default file context for directories that Magento needs to write to, and the `restorecon` command applies the contexts in policy to the files on disk.

The first command sets an environment variable to the root directory of your Magento installation directory. You must verify and substitute the correct path to your installation. The `semanage` commands set the default file context for directories that Magento needs to write to. The `restorecon` command applies the contexts in policy to the files on disk.

jeff-matthews · 2018-12-13T19:57:44Z

guides/v2.0/install-gde/prereq/security.md

-The preceding commands work only with the Apache web server. Because of the variety of configurations and security requirements, we don't guarantee these commands work in all situations. For more information, see:
+The first command sets an environment variable to the root directory of your Magento installation directory, verify and substitute the correct path.  The `semanage` commands set the default file context for directories that Magento needs to write to, and the `restorecon` command applies the contexts in policy to the files on disk.  
+
+New files will then automatically inherit the context of the directory they are created in, and stay with the file when it moves.  If you have a deployment method that creates files in a scratch directory then moves (ie `mv /home/frank/jar.css $mageroot/`) them into the web server's document root, you should use `restorecon` to restore the proper context to your files.


Suggested change

New files will then automatically inherit the context of the directory they are created in, and stay with the file when it moves. If you have a deployment method that creates files in a scratch directory then moves (ie `mv /home/frank/jar.css $mageroot/`) them into the web server's document root, you should use `restorecon` to restore the proper context to your files.

New files inherit the context of the directory in which they are created and stay with the file when it moves. If you have a deployment method that creates files in a scratch directory and then moves them into the web server's document root (for example `mv /home/frank/jar.css $mageroot/`), you should use the `restorecon` command to restore the proper context to your files.

jeff-matthews · 2018-12-13T19:58:12Z

guides/v2.0/install-gde/prereq/security.md

+
+New files will then automatically inherit the context of the directory they are created in, and stay with the file when it moves.  If you have a deployment method that creates files in a scratch directory then moves (ie `mv /home/frank/jar.css $mageroot/`) them into the web server's document root, you should use `restorecon` to restore the proper context to your files.
+
+This example is known to work with Apache, and may work with other packaged web servers, but because of the variety of configurations and security requirements, we don't guarantee these commands work in all situations.  For more information, see:


Suggested change

This example is known to work with Apache, and may work with other packaged web servers, but because of the variety of configurations and security requirements, we don't guarantee these commands work in all situations. For more information, see:

This example is known to work with Apache and may work with other packaged web servers, but because of the variety of configurations and security requirements, we cannot guarantee these commands work in all situations. For more information, see:

magento-cicd2 · 2018-12-21T22:02:26Z

An admin must run tests on this PR before it can be merged.

hguthrie · 2019-02-19T17:15:09Z

There has been no communication for some time; we are closing this pull request. If you have further comments and feedback, please create an issue or a new pull request. Thanks for taking the time to contribute to docs improvement!

ghost · 2019-02-19T17:15:10Z

Hi @immanetize, thank you for your contribution!
Please, complete Contribution Survey, it will take less than a minute.
Your feedback will help us to improve contribution process.

recommend semanage fcontext for selinux

16b36ee

jcalcaben assigned jfrontain Aug 24, 2017

magento-cicd2 pushed a commit that referenced this pull request Oct 27, 2017

Merge pull request #1336 from magento/kh_2.0-rest-typo

94bd152

Fix typos

jeff-matthews changed the base branch from develop to master July 17, 2018 13:53

szurek approved these changes Nov 6, 2018

View reviewed changes

magento deleted a comment from magento-cicd2 Nov 14, 2018

jeff-matthews assigned jeff-matthews and unassigned jfrontain Dec 13, 2018

jeff-matthews added the 2.x label Dec 13, 2018

jeff-matthews requested changes Dec 13, 2018

View reviewed changes

jeff-matthews added the Major Update Significant original updates to existing content label Dec 13, 2018

jeff-matthews added the Waiting for Response Waiting for response from internal/external parties label Feb 12, 2019

hguthrie closed this Feb 19, 2019

hguthrie removed Waiting for Response Waiting for response from internal/external parties labels Feb 19, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

recommend `semanage fcontext` for selinux #1336

recommend `semanage fcontext` for selinux #1336

immanetize commented Aug 1, 2017 •

edited by jeff-matthews

Loading

jeff-matthews commented Dec 13, 2018

jeff-matthews Dec 13, 2018

jeff-matthews Dec 13, 2018

jeff-matthews Dec 13, 2018

jeff-matthews Dec 13, 2018

magento-cicd2 commented Dec 21, 2018

hguthrie commented Feb 19, 2019

ghost commented Feb 19, 2019


		The preceding commands work only with the Apache web server. Because of the variety of configurations and security requirements, we don't guarantee these commands work in all situations. For more information, see:
		The first command sets an environment variable to the root directory of your Magento installation directory, verify and substitute the correct path. The `semanage` commands set the default file context for directories that Magento needs to write to, and the `restorecon` command applies the contexts in policy to the files on disk.

	New files will then automatically inherit the context of the directory they are created in, and stay with the file when it moves. If you have a deployment method that creates files in a scratch directory then moves (ie `mv /home/frank/jar.css $mageroot/`) them into the web server's document root, you should use `restorecon` to restore the proper context to your files.
	New files inherit the context of the directory in which they are created and stay with the file when it moves. If you have a deployment method that creates files in a scratch directory and then moves them into the web server's document root (for example `mv /home/frank/jar.css $mageroot/`), you should use the `restorecon` command to restore the proper context to your files.


		New files will then automatically inherit the context of the directory they are created in, and stay with the file when it moves. If you have a deployment method that creates files in a scratch directory then moves (ie `mv /home/frank/jar.css $mageroot/`) them into the web server's document root, you should use `restorecon` to restore the proper context to your files.

		This example is known to work with Apache, and may work with other packaged web servers, but because of the variety of configurations and security requirements, we don't guarantee these commands work in all situations. For more information, see:

recommend semanage fcontext for selinux #1336

recommend semanage fcontext for selinux #1336

Conversation

immanetize commented Aug 1, 2017 • edited by jeff-matthews Loading

jeff-matthews commented Dec 13, 2018

jeff-matthews Dec 13, 2018

Choose a reason for hiding this comment

jeff-matthews Dec 13, 2018

Choose a reason for hiding this comment

jeff-matthews Dec 13, 2018

Choose a reason for hiding this comment

jeff-matthews Dec 13, 2018

Choose a reason for hiding this comment

magento-cicd2 commented Dec 21, 2018

hguthrie commented Feb 19, 2019

ghost commented Feb 19, 2019

recommend `semanage fcontext` for selinux #1336

recommend `semanage fcontext` for selinux #1336

immanetize commented Aug 1, 2017 •

edited by jeff-matthews

Loading